chaas/debshots
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Authorisation management using CanCanCan added

Browse source
This commit is contained in:
Christoph Haas 2021-02-28 21:36:46 +01:00
parent 51be4a4777
commit 7a3b65fe50
24 changed files with 211 additions and 295 deletions
Download patch file Download diff file Expand all files Collapse all files

80
app/controllers/packages_controller.rb
View file

@ -37,10 +37,6 @@ class PackagesController < ApplicationController
# This action saves the screenshots already if they are valid. The user is
# then given the chance to comment on and delete the screenshots again.
def upload_receive
# Create a pseudo user account for the user.
# The user won't know that an account is created.
# But this makes it easier to track who screenshots belong to.
# User.create_pseudo_user unless user_signed_in?
@package = Package.find_by!(name: params[:name])
@valid_images = []
@invalid_images = []
@ -65,7 +61,7 @@ class PackagesController < ApplicationController
# Check if the image was valid
if new_screenshot.valid?
new_screenshot.uploaderhash = session.id.to_s
# new_screenshot.uploaderhash = session.id.to_s
new_screenshot.uploaderip = request.remote_ip
new_screenshot.version = @package.version
# ActiveStorage does not yet create a file checksum automatically.
@ -77,19 +73,25 @@ class PackagesController < ApplicationController
Log.log "Duplicate image with fingerprint #{new_screenshot.image_fingerprint} found. Rejecting."
all_errors << "Your file #{img.original_filename} is a duplicate. Sorry."
else
# Can the upload get approved automatically?
if user_signed_in?
new_screenshot.user = current_user
new_screenshot.approve! if auto_approve?
end
# TODO: Can the upload get approved automatically?
# Create a pseudo user account for the user.
# The user won't know that an account is created.
# But this makes it easier to track who screenshots belong to.
unless user_signed_in?
sign_in User.create_pseudo_user
end
new_screenshot.user = current_user
new_screenshot.approve! if can?(:approve, new_screenshot)
# Pre-render screenshot in different sizes
new_screenshot.simage_derivatives!
Log.log "Derivatives created"
new_screenshot.save!
Log.log "Screenshot #{new_screenshot.id} uploaded successfully. " + \
"ip=#{new_screenshot.uploaderip}. "+ \
"user-hash=#{new_screenshot.uploaderhash}. "+ \
#"user-hash=#{new_screenshot.uploaderhash}. "+ \
"user-name=#{current_user} "+ \
"image-fingerprint=#{new_screenshot.image_fingerprint} "+ \
"image-path=#{img.path}"
@ -174,7 +176,7 @@ class PackagesController < ApplicationController
# Check if the user is allowed to change this screenshot
# - Is this the user's own screenshot? (anonymous)
if @screenshot.user == current_user or current_user.is_admin?
if (@screenshot.user == current_user) || (can? :detroy, @screenshot)
logger.debug "User #{current_user} deletes screenshot #{@screenshot}"
@screenshot.destroy
flash['notice'] = "Screenshot deleted."
@ -185,8 +187,9 @@ class PackagesController < ApplicationController
end
def approve_screenshot
if current_user && current_user.is_admin?
@screenshot = Screenshot.find(params[:id])
@screenshot = Screenshot.find(params[:id])
if can? :approve, @screenshot
@screenshot.approve!
flash['notice'] = "Screenshot approved."
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
@ -263,23 +266,6 @@ class PackagesController < ApplicationController
redirect_back(fallback_location: package_path(name: @screenshot.package.name))
end
# Receive an anonymous report from a user to have a screenshot removed.
# def report_screenshot
# @screenshot = Screenshot.find(params[:id])
# # if verify_recaptcha
# @screenshot.delete_reason = params[:delete_reason]
# @screenshot.markedfordelete = true
# if @screenshot.valid?
# @screenshot.save!
# flash['notice'] = "Screenshot reported. The moderators will deal with it."
# else
# errors = @screenshot.errors.to_a.join(' and ')
# flash['alert'] = "Sorry. #{errors}"
# end
# # end
# redirect_back(fallback_location: package_path)
# end
# Show an HTML partial with reviews of this package from the Ubuntu API
# def reviews
# expires_in 1.day, public: true
@ -350,37 +336,7 @@ class PackagesController < ApplicationController
params.require(:screenshot).permit(:description)
end
# Do uploads from this user get approved automatically?
def auto_approve?
# Anonymous users need to go through moderation
return false unless user_signed_in?
# Admins do not need moderation
return true if current_user.is_admin?
# Debian developers do not need moderation
return true if current_user.provider == 'debian-sso'
# After one successfully approved screenshot users do not need moderation
# return true if current_user.approved_screenshots.count > 0
# Any other user's upload must be moderated
return false
end
def screenshots_visible_to_user(package)
if user_signed_in? and current_user.is_admin?
# User is an admin and can view all screenshots
package.screenshots
# TODO: User logins and assigned screenshots will come in a later version
# elsif user_signed_in?
# package.screenshots.where(id: (current_user.screenshots.select(:id))) | \
# package.screenshots.where(approved: true).order('created_at DESC')
else
package.screenshots.where(uploaderhash: session.id.to_s).or(
package.screenshots.where(approved: true)
)
.order('created_at DESC')
end
package.screenshots.accessible_by(current_ability, :view).order('created_at DESC')
end
end